Are many people STILL experiencing these problems even after the ClamAV DB fix?

One could only hope 0.99.3 solves it, but...

These are the issues it covers according to Johannes W.'s email to the list:

- Update to security release 0.99.3 (bsc#1077732)
  * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
  * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
  * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
    - these vulnerabilities could have allowed an unauthenticated,
      remote attacker to cause a denial of service (DoS) condition
      or potentially execute arbitrary code on an affected device.
  * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
  * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
  * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
  * CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
    - these vulnerabilities could have allowed an unauthenticated,
      remote attacker to cause a denial of service (DoS) condition on an affected device.
  * CVE-2017-6420 (bsc#1052448)
    - this vulnerability allowed remote attackers to cause a denial of service
      (use-after-free) via a crafted PE file with WWPack compression.
  * CVE-2017-6419 (bsc#1052449)
    - ClamAV allowed remote attackers to cause a denial of service
      (heap-based buffer overflow and application crash) or possibly
      have unspecified other impact via a crafted CHM file.
  * CVE-2017-11423 (bsc#1049423)
    - The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha
      allowed remote attackers to cause a denial of service
      (stack-based buffer over-read and application crash) via a crafted CAB file.
  * CVE-2017-6418 (bsc#1052466)
    - ClamAV 0.99.2 allowed remote attackers to cause a denial
      of service (out-of-bounds read) via a crafted e-mail message.


On 1/26/2018 6:44 PM, Jeff Koch wrote:
Eric - does anyone know if this solves the problem?  Jeff

On 1/26/2018 8:37 PM, Eric Broch wrote:
Hello list members,

The ClamAV 0.99.3 RPMS/SRPMS for COS 6 (i386, x86_64) & 7 (x86_64) are available for download or you can use Yum with the --enablerepo=qmt-testing option

ftp://ftp.qmailtoaster.com/pub/repo/qmt/CentOS/7/testing/x86_64/clamav-0.99.3-1.qt.el7.x86_64.rpm

ftp://ftp.qmailtoaster.com/pub/repo/qmt/CentOS/7/testing/SRPMS/clamav-0.99.3-1.qt.el7.src.rpm

ftp://ftp.qmailtoaster.com/pub/repo/qmt/CentOS/6/testing/x86_64/clamav-0.99.3-1.qt.el6.x86_64.rpm

ftp://ftp.qmailtoaster.com/pub/repo/qmt/CentOS/6/testing/i386/clamav-0.99.3-1.qt.el6.i686.rpm

ftp://ftp.qmailtoaster.com/pub/repo/qmt/CentOS/6/testing/SRPMS/clamav-0.99.3-1.qt.el6.src.rpm


Eric



---------------------------------------------------------------------
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com



Reply via email to